HIGH

GHSA-rcfx-77hg-w2wv

FastMCP updated to MCP 1.23+ due to CVE-2025-66416

Quick fix

GHSA-rcfx-77hg-w2wv — fastmcp: upgrade to the fixed version with the command below.

pip install --upgrade 'fastmcp>=2.14.0'

Details

There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.

FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/fastmcp

Introduced in: 0Fixed in: 2.14.0

Fixpip install --upgrade 'fastmcp>=2.14.0'

References

https://github.com/jlowin/fastmcp/security/advisories/GHSA-rcfx-77hg-w2wv[WEB]
https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2025-66416[ADVISORY]
https://github.com/jlowin/fastmcp[PACKAGE]